Privacy
notice.

This notice explains how Coastal Fire Systems Ltd ("we", "us", "our") collects and uses personal data — through this website, over the phone, by email and while we work for you — in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Coastal Fire Systems Ltd is the data controller for the personal data described in this notice.

• Company: Coastal Fire Systems Ltd, registered in England & Wales, company no. 14981366
• Registered office: Unit 24, The Acre, Dappers Lane, Angmering, Littlehampton, BN16 4EN
• ICO registration: ZC157037
• Email: info@coastal-fire-systems.co.uk
• Phone: 01903 771 949 (office) · 07835 903 856 (24/7 emergencies)

2. What personal data we collect

• Enquiry form — your name, email address, phone number (optional), property postcode (optional), the service you need and your message.
• Callback form — your name and phone number.
• Phone calls, including emergency callouts — your name, number, site address and details of the problem, plus notes our team makes about the call.
• Customer records — contact names, billing and site addresses, purchase orders, service history, certificates and reports for the systems we look after.
• Site surveys and fire risk assessments — photos, sketches and technical notes. Occasionally a fire risk assessment needs to note people who'd need extra help to escape (for example, someone with limited mobility). We only record what's needed to keep people safe and treat it as confidential.
• Correspondence — emails, texts and letters between you and us.
• Spam-protection data — when you use a form, our spam checker (hCaptcha) collects technical information such as your IP address, browser and device details, and how you interact with the check.
• Server logs — like every website, our hosting provider automatically logs technical details of visits (such as IP address, browser and pages requested) to keep the site secure and working.

We don't use analytics or advertising trackers, and we don't knowingly collect data from children.

3. Why we use it, and our lawful basis

• To reply to enquiries, callbacks and quote requests — steps taken at your request before entering into a contract (Article 6(1)(b)), or our legitimate interest in responding to people who contact us (Article 6(1)(f)).
• To deliver our services (installation, servicing, callouts, assessments and certification) — performance of a contract (Article 6(1)(b)).
• To meet legal obligations — such as tax and accounting records, and fire safety record-keeping (Article 6(1)(c)).
• To protect our website and forms from spam and abuse — our legitimate interest in keeping the site secure (Article 6(1)(f)).
• To send service reminders to existing customers — our legitimate interest in maintaining the systems we look after (Article 6(1)(f)).
• When we work as a subcontractor — to carry out the work our client (the main contractor) has asked us to do, which may involve site contact details they give us (Article 6(1)(f)).

We don't send marketing emails. If we ever want to, we'll only do so where the law allows, and you'll always be able to opt out. We don't use your data for automated decision-making or profiling, and we never sell it.

4. Who we share it with

We only share personal data where it's needed, with organisations that help us run the business:

• Web3Forms — the service that delivers website form submissions to our email inbox.
• hCaptcha (Intuition Machines, Inc., USA) — spam protection on our forms. See hCaptcha's privacy policy.
• Google Fonts (Google LLC) — supplies the typefaces on this website, so your browser sends your IP address to Google to download them. See Google's privacy policy.
• Our website host (Namecheap) — stores the website and its server logs.
• Our email and document storage provider (Microsoft 365).
• Our accountant and HMRC, for invoicing and tax.
• Card payment processors, if you pay by card.
• Equipment manufacturers' technical support, where a fault needs it — usually system data only, not your personal details unless you ask us to share them.
• Main contractors, where we're working as their subcontractor on your project.
• Regulators, insurers, fire and rescue authorities or the courts, where the law requires it.

5. International transfers

Some of the providers above (including hCaptcha and Google, and possibly Web3Forms and our website host) may process data outside the UK, including in the USA. Where that happens, the transfer is covered either by UK "adequacy" regulations (including the UK–US data bridge for certified companies) or by appropriate safeguards such as the ICO's International Data Transfer Agreement or Addendum.

6. How long we keep it

• Enquiries and callback requests that don't lead to work — up to 24 months from our last contact, then deleted.
• Customer records, contracts and invoices — 7 years after the contract ends, for accounting and warranty purposes.
• Fire alarm certificates and fire risk assessments — for the life of the system plus 6 years, in line with fire safety record-keeping good practice.
• Email correspondence — up to 7 years, then deleted.
• Spam-protection data and server logs — held by hCaptcha and our host under their own retention policies, usually for a short period.

7. How we keep it safe

Only the people who need customer data can access it. Our devices are password-protected and encrypted, our cloud accounts use two-factor authentication, and we keep our systems up to date. This website is served over HTTPS, and paper records (such as site survey notes) are kept in locked storage.

8. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you (a "subject access request");
• ask us to correct anything that's wrong;
• ask us to delete your data where there's no legal reason for us to keep it;
• ask us to restrict, or object to, how we use it;
• ask us to transfer it to another organisation (data portability);
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email info@coastal-fire-systems.co.uk with "Data request" in the subject line, or write to our registered office. We'll respond within one month. It's free in most cases.

9. Cookies and similar technologies

We don't use advertising or analytics cookies. Our spam checker may store small strictly-necessary items in your browser when a form loads, and our contact form saves the time of your last enquiry so you don't send it twice by accident. Full details are in our Cookie Policy.

10. Complaints

If you're unhappy with how we've handled your data, please talk to us first — we'd much rather put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this notice

We'll update this notice if the way we use personal data changes. The date at the top shows when it was last updated.